{ "response": [ { "Event": { "uuid": "844054d6-b0c7-5424-b1c7-f1972d901723", "info": "Xen Orchestrator authentication bypass actually exploited... virtualization hosts can also be compromised", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"exploitation\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/xen-orchestrator-authentication-bypass-actually-exploited-virtualizati-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209467", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "625789ea-a4bb-5a91-88c0-6a13de35295c", "info": "'National functions continue even if hacked'... Pan-government task force for national cyber resilience launched", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"intrusion\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/national-functions-continue-even-if-hacked-pan-government-task-force-f-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147225", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: intrusion; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "40279790-6861-5d1d-b2f0-eaf5a0bed0c1", "info": "S. Korea, Belgium discuss leak of personal data of President Lee, Europe trip entourage", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"belgium\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/s-korea-belgium-discuss-leak-of-personal-data-of-president-lee-europe-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261112009400315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Nov 12, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. EU member states named: Belgium. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1c798eeb-711e-5886-ac2a-27b51d553ea7", "info": "Virtual asset exchange Flybit hacked, resident registration numbers and tax information of 40 customers leaked", "date": "2026-11-12", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"crypto_theft\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/virtual-asset-exchange-flybit-hacked-resident-registration-numbers-and-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209490", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a94f11e5-d1e1-5264-8e5a-03cffabbf3c3", "info": "Personal information leaked at Secta9ine, a subsidiary of 'Happy Point operator' SPC Group", "date": "2026-11-12", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/personal-information-leaked-at-secta9ine-a-subsidiary-of-happy-point-o-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147199", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "0fe09d1e-3cdf-56f4-ab93-88c4e7a7a8da", "info": "150,000 personal records leaked in hacking of 4 Samyang Group companies... includes 80,000 resident registration numbers", "date": "2026-11-12", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/150000-personal-records-leaked-in-hacking-of-4-samyang-group-companies-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209475", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "d9037bfa-2852-5f77-8336-ed9dcf8c7a4f", "info": "Samsung SDS subsidiary Multicampus hacked, personal information of about 70,000 employees leaked", "date": "2026-11-12", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/samsung-sds-subsidiary-multicampus-hacked-personal-information-of-abou-20261112/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209491", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 12, 2026. Title machine-translated from Korean. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "0ff2b99c-8c6e-5ff0-bd18-89c102769cb2", "info": "Government conducts ex officio investigation into GS E&C over 'Xi' resident information leak... first case decided after deliberation", "date": "2026-11-11", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/gs-20261111/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147194", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209460", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Boannews (Korean), Dailysecu (Korean)), Nov 11 to Nov 12, 2026. Title machine-translated from Korean. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "bb4fe31b-4eab-5dc9-b98e-67c903001271", "info": "Hanil Networks hit by ransomware attack... 'Blocked immediately, no data leakage'", "date": "2026-11-10", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"ransomware\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/incident-20261110-3/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147152", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 10, 2026. Title machine-translated from Korean. Type: ransomware. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4fa495ac-36d0-5e1d-8001-31d1616dc9e1", "info": "Financial Security Institute reports data leak following hacking attack", "date": "2026-11-10", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/incident-20261110-4/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147156", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261110010600315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261110010651315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209438", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147183", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209448", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209450", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 7 articles in 3 outlets (Boannews (Korean), Dailysecu (Korean), Yonhap), Nov 10 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6d10bffe-3813-5392-abaf-c644104cd87d", "info": "Phishing notification sent impersonating parking app 'Get your reward'... External agency breached", "date": "2026-11-10", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/phishing-notification-sent-impersonating-parking-app-get-your-reward-e-20261110/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.boannews.com/news/articleView.html?idxno=147150", "comment": "Boannews (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 10, 2026. Title machine-translated from Korean. Type: data breach; sectors: government, technology. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "0371b784-ac08-5e1b-ad1a-e17f618ef9bd", "info": "ZoomZoom Tour, personal information leaked due to hacking and development errors... travel schedules and companion information also exposed", "date": "2026-11-10", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/incident-20261110-2/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209422", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 10, 2026. Title machine-translated from Korean. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1bc09e60-d48b-59ff-9227-e5d911f09a5f", "info": "SonicWall SSL-VPN authentication bypass vulnerability exploited in actual attacks, multi-factor authentication also neutralized", "date": "2026-11-09", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"exploitation\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/sonicwall-ssl-vpn-authentication-bypass-vulnerability-exploited-in-act-20261109/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209394", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "vulnerability", "category": "External analysis", "value": "CVE-2026-19868", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "76188bea-6560-56fa-b585-e9fb1cc8e389", "info": "Ransomware group N0n claims to have hacked company related to Korean smart TV advertising data", "date": "2026-11-09", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"ransomware\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/ransomware-group-n0n-claims-to-have-hacked-company-related-to-korean-s-20261109/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.dailysecu.com/news/articleView.html?idxno=209395", "comment": "Dailysecu (Korean)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: ransomware. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6eb20c15-2e94-5172-8c2c-bb1d822f59b8", "info": "Mirae Asset says data breaches exposed customer, employee information", "date": "2026-11-06", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/mirae-asset-says-data-breaches-exposed-customer-employee-information-20261106/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000400315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261107000451315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10929242", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ciso.economictimes.indiatimes.com/news/data-breaches/personal-info-of-39000-persons-leaked-from-mirae-asset-securities/135669047", "comment": "ETCISO (Economic Times)", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 4 articles in 3 outlets (ETCISO (Economic Times), The Korea Herald, Yonhap), Nov 6 to Nov 9, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea, India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e5be2210-f7e1-562b-8dc6-5c8f93a6d26a", "info": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns", "date": "2026-11-05", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"Storm-0940\"" }, { "name": "misp-galaxy:country=\"hong kong\"" }, { "name": "misp-galaxy:country=\"cambodia\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/", "comment": "Check Point Research", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "comment": "Microsoft Threat Intelligence", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "146c35ff-de36-5c8d-8d30-3156bd41522c", "info": "Over 470,000 pieces of personal data leaked from 37 financial firms: FSC", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/over-470000-pieces-of-personal-data-leaked-from-37-financial-firms-fsc-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261105002400320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261105/over-470000-pieces-of-personal-data-leaked-from-37-financial-firms-fsc?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Korea Times, Yonhap), Nov 5, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "fa0dbed4-0d63-5915-a7d0-05565b659847", "info": "Most gov't agencies deny using VirusTotal, deepening questions over presidential data leak", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/most-govt-agencies-deny-using-virustotal-deepening-questions-over-pres-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/politics/20261105/most-govt-agencies-deny-using-virustotal-deepening-questions-over-presidential-data-leak?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Korea Times), Nov 5, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "19d01182-8092-5d15-a580-fa1c61784bf5", "info": "South Korea investigates 580 finance firms over data leaks, issues warning", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/south-korea-investigates-580-finance-firms-over-data-leaks-issues-warn-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/week-asia/economics/article/3373363/south-korea-investigates-580-finance-firms-over-data-leaks-issues-warning", "comment": "South China Morning Post", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (South China Morning Post), Nov 5, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "c18c6e86-d995-5834-b867-fa6f0dc7a52d", "info": "Foreign ministry looking to contractor over presidential personal info leak", "date": "2026-11-05", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/foreign-ministry-looking-to-contractor-over-presidential-personal-info-20261105/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10927143", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Nov 5, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "d8b0252a-827c-5bb5-802f-2ae6612a6f9e", "info": "Cheong Wa Dae orders probes into data leak of Lee, aides, security guards", "date": "2026-11-03", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/cheong-wa-dae-orders-probes-into-data-leak-of-lee-aides-security-guard-20261103/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10923743", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10924108", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 1 outlet (The Korea Herald), Nov 3, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "ca649294-37b3-58a6-b905-21498e809401", "info": "Personal information of Lee, presidential staff leaked: report", "date": "2026-11-02", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/personal-information-of-lee-presidential-staff-leaked-report-20261102/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261102013200320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261102013251320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103003700315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10923757", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103003751315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-03/1069015", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261103010400315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261103de70007", "comment": "NHK", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_national/1285585.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_national/1285767.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 11 articles in 6 outlets (Hankyoreh, NHK, New Talk, South China Morning Post, The Korea Herald, Yonhap), Nov 2 to Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "78090cc0-ec70-5383-bd05-b8d09a7067e2", "info": "Data on 16,000 people compromised at 3 Seoul international schools in PowerSchool breach", "date": "2026-11-02", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Education\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/data-on-16000-people-compromised-at-3-seoul-international-schools-in-p-20261102/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10922866", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Nov 2, 2026. Type: data breach; sectors: education. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1936f227-2555-556b-92d4-7f48f4860626", "info": "Binance TH pauses crypto transfers, says Thai funds safe after hack", "date": "2026-10-30", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"crypto_theft\"" }, { "name": "misp-galaxy:threat-actor=\"TraderTraitor\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"thailand\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack", "comment": "The Thaiger", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-10-30/1068375", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://ec.ltn.com.tw/article/breakingnews/5624143", "comment": "Liberty Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000200315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000251315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261031000252315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4", "comment": "Japan Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921226", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000300315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-01/1068564", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921526", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261101de69102", "comment": "NHK", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10921777", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261101000351315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975", "comment": "Taipei Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://newtalk.tw/news/view/2026-11-02/1068750", "comment": "New Talk", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/", "comment": "NK Pro", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/", "comment": "NK News", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311", "comment": "Channel News Asia", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/", "comment": "The Japan Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation", "comment": "Free Malaysia Today", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation", "comment": "South China Morning Post", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html", "comment": "VN Express", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://news.web.nhk/newsweb/na/nd-20261103de69881", "comment": "NHK", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "1d3d53c2-5120-59b0-9f4c-da41554bdc2a", "info": "Hundreds of customers' personal information at Bithumb leaked in hacks", "date": "2026-10-29", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/hundreds-of-customers-personal-information-at-bithumb-leaked-in-hacks-20261029/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261029012000320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10919604", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (The Korea Herald, Yonhap), Oct 29, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "b67d48ad-cdf3-518c-b49d-661bcd4202fb", "info": "(LEAD) South Korean financial firms confirm data breach of customer data", "date": "2026-10-28", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lead-south-korean-financial-firms-confirm-data-breach-of-customer-data-20261028/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261028002751320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 28, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a68f78aa-d5fa-5a5f-a8e7-521e5f41a6c0", "info": "Cyberattack wave widens across Korean financial sector", "date": "2026-10-28", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/cyberattack-wave-widens-across-korean-financial-sector-20261028/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10917639", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 28, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4231ab55-afda-5056-8c62-4cdbc68dc149", "info": "KB Kookmin Bank finds 2,091 more people affected by data leak", "date": "2026-10-26", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/kb-kookmin-bank-finds-2091-more-people-affected-by-data-leak-20261026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261026010200315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10915394", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (The Korea Herald, Yonhap), Oct 26, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "3117d446-07fc-5cac-b4a4-9d4df3f2dced", "info": "Yonsei Univ. portal hack leaks data of 10,000 students, graduates", "date": "2026-10-22", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Education\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/yonsei-univ-portal-hack-leaks-data-of-10000-students-graduates-20261022/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261022003300315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/education/20261022/yonsei-university-portal-hack-leaks-data-of-10000-students-graduates?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (Korea Times, Yonhap), Oct 22, 2026. Type: data breach; sectors: education. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "8d643df4-4a20-5724-8407-3df507b05528", "info": "2.76 mln pieces of customers' info at Hollys leaked in cyberattack", "date": "2026-10-19", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/276-mln-pieces-of-customers-info-at-hollys-leaked-in-cyberattack-20261019/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261019008600320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 19, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Largest figure in the headlines: 2,760,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "39a545b7-cdf8-58b1-bd4d-bb1335c83983", "info": "AI makes cyberattacks cheaper, harder to ignore: Cloudflare executive", "date": "2026-10-19", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/ai-makes-cyberattacks-cheaper-harder-to-ignore-cloudflare-executive-20261019/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10907396", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 19, 2026. Type: other; sectors: technology. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "96ac254c-4bea-5df2-a746-5f42e95e5e1d", "info": "Top bank chiefs face grilling over cyberattacks", "date": "2026-10-18", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/top-bank-chiefs-face-grilling-over-cyberattacks-20261018/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10906198", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 18, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "6221fecc-3d64-5ef6-a6ef-a1f25237b97b", "info": "Personal info presumed to have leaked from 16 financial institutions: regulator", "date": "2026-10-14", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/personal-info-presumed-to-have-leaked-from-16-financial-institutions-r-20261014/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261014006900320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 14, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "d6468d56-d3a3-50ad-b9e9-c5ab7907faa9", "info": "AI-powered attacks on Korean financial sectors linked to Chinese DDoS group: report", "date": "2026-10-11", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"ddos\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/ai-powered-attacks-on-korean-financial-sectors-linked-to-chinese-ddos-20261011/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10898597", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 11, 2026. Type: ddos; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a738999a-f2b0-5880-ba7f-6aaae536cea4", "info": "Coupang files lawsuits against 620 bln-won fine over data leak", "date": "2026-10-08", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/coupang-files-lawsuits-against-620-bln-won-fine-over-data-leak-20261008/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261008008700320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 8, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "27acc24b-612d-5aeb-8722-ac242eefbaeb", "info": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks", "date": "2026-10-07", "threat_level_id": "1", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html", "comment": "Hankyoreh", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a8b50939-898c-5419-aafa-598548ea4742", "info": "Multiple IPs used to hide origin of recent cyberattacks against financial firms", "date": "2026-10-07", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/multiple-ips-used-to-hide-origin-of-recent-cyberattacks-against-financ-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261007005000315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 7, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "c869f62c-9995-5dd5-a470-cf8eed935deb", "info": "Two mega churches hit by suspected data breaches", "date": "2026-10-07", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/two-mega-churches-hit-by-suspected-data-breaches-20261007/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10895635", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (The Korea Herald), Oct 7, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e01e2aec-e24c-5526-9de9-ab86e8f61f14", "info": "19 IP addresses behind recent hacking attacks against Korean financial institutions: watchdog", "date": "2026-10-06", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"intrusion\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/19-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-20261006/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261006005000320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261006005051320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261006/19-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-institutions-watchdog?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreatimes.co.kr/southkorea/law-crime/20261006/28-ip-addresses-behind-recent-hacking-attacks-against-korean-financial-institutions-watchdog?utm_source=rss", "comment": "Korea Times", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261009003600315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261009003651315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 6 articles in 2 outlets (Korea Times, Yonhap), Oct 6 to Oct 9, 2026. Type: intrusion; sectors: government, financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "3e175698-9ffd-56e1-baba-dca2aa571bd5", "info": "Loạt ngân hàng Hàn Quốc liên tiếp bị tấn công mạng", "date": "2026-10-05", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"intrusion\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/loat-ngan-hang-han-quoc-lien-tiep-bi-tan-cong-mang-20261005/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://vnexpress.net/loat-ngan-hang-han-quoc-lien-tiep-bi-tan-cong-mang-5128451.html", "comment": "VN Express", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (VN Express), Oct 5, 2026. Type: intrusion. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "61ace89f-32c9-5427-9f54-e7a8c1c953fa", "info": "Lee calls for thorough probe into personal data leaks at financial institutions", "date": "2026-10-04", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lee-calls-for-thorough-probe-into-personal-data-leaks-at-financial-ins-20261004/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261004002100315", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10892927", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261004002151315", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 3 articles in 2 outlets (The Korea Herald, Yonhap), Oct 4, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "f3551d60-9f23-534d-8f93-bea2091114c5", "info": "(2nd LD) Regulator instructs financial firms to check security systems over series of cyberattacks on banks", "date": "2026-10-02", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/2nd-ld-regulator-instructs-financial-firms-to-check-security-systems-o-20261002/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009152320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 1 article in 1 outlet (Yonhap), Oct 2, 2026. Type: other; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "55a6564d-68e7-5cef-b137-2793678a5244", "info": "(LEAD) Some 25,000 customers' info leaked from Shinhan Bank in apparent AI agent-assisted hacking", "date": "2026-10-01", "threat_level_id": "2", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lead-some-25000-customers-info-leaked-from-shinhan-bank-in-apparent-ai-20261001/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261001006351320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10891104", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002004900320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002004951320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009100320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10892290", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20261002009151320", "comment": "Yonhap", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 7 articles in 2 outlets (The Korea Herald, Yonhap), Oct 1 to Oct 2, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "e1a61d0d-4fce-5343-acc6-e7b20391bcc3", "info": "Nearly 4 in 10 S. Korean industrial technology leaks involve semiconductors: data", "date": "2026-09-27", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/nearly-4-in-10-s-korean-industrial-technology-leaks-involve-semiconduc-20260927/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://en.yna.co.kr/view/AEN20260927000800320", "comment": "Yonhap", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10885167", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 2 outlets (The Korea Herald, Yonhap), Sep 27, 2026. Type: data breach; sectors: manufacturing. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "b214b011-e352-5ad1-8fdb-06ed77f71141", "info": "Coupang forms security panel after massive data breach", "date": "2026-09-15", "threat_level_id": "3", "analysis": "0", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"detected-unreviewed\"" }, { "name": "securitystudies:type=\"data_breach\"" }, { "name": "misp-galaxy:country=\"south korea\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/coupang-forms-security-panel-after-massive-data-breach-20260915/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10874209", "comment": "The Korea Herald", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.koreaherald.com/article/10876064", "comment": "The Korea Herald", "to_ids": false }, { "type": "text", "category": "Other", "value": "Detected automatically from 2 articles in 1 outlet (The Korea Herald), Sep 15 to Sep 16, 2026. Type: data breach. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "91b0e4ed-1cae-581b-804b-aaed6cc8a5f8", "info": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media\"" }, { "name": "misp-galaxy:sector=\"Technology\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "a33a801c-155e-55ff-a042-ba68fbef2d44", "info": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "date": "2026-09-04", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"other\"" }, { "name": "misp-galaxy:country=\"united states\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"australia\"" }, { "name": "misp-galaxy:country=\"india\"" }, { "name": "misp-galaxy:sector=\"Government\"" }, { "name": "misp-galaxy:sector=\"Technology\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Healthcare\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "98ed5a28-001f-5c9c-be72-67b4f6d8f172", "info": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies", "date": "2026-09-01", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:threat-actor=\"APT37\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"Automotive Manufacturing\"" }, { "name": "misp-galaxy:sector=\"Media and Broadcasting\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html", "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "555c9614-2fc1-5b9c-9a58-8d1170ae14cd", "info": "SafePay Ransomware Claims Air Liquide Korea", "date": "2026-08-25", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"ransomware\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"manufacturing\"" }, { "name": "misp-galaxy:sector=\"chemicals\"" }, { "name": "misp-galaxy:sector=\"industrial gases\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "cd95d4e1-67d8-5194-b1c7-c10eac110489", "info": "Nine-Month Intrusion at Korea National Diplomatic Academy Exposes Diplomat Data", "date": "2026-07-21", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"espionage\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:sector=\"government\"" }, { "name": "misp-galaxy:sector=\"diplomacy\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/nine-month-intrusion-at-korea-national-diplomatic-academy-exposes-diplomat-data/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": "https://therecord.media/south-korea-cyberattack-foreign-ministry", "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "South Korea's Ministry of Foreign Affairs disclosed that attackers exploited a vulnerability in the Korea National Diplomatic Academy's online training platform and maintained access from April 2025 until detection in February 2026. Roughly 10,000 records covering about 6,000 current and former diplomats were exposed, including names, user IDs, emails, encrypted passwords, titles and department affiliations; investigators are examining possible North Korean involvement.", "comment": "summary", "to_ids": false } ] } }, { "Event": { "uuid": "4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "info": "Lazarus Group Cryptocurrency Exchange Heist — Singapore", "date": "2026-04-28", "threat_level_id": "1", "analysis": "2", "distribution": "3", "published": false, "Orgc": { "name": "SecurityStudies.info" }, "Tag": [ { "name": "tlp:clear" }, { "name": "securitystudies:status=\"curated\"" }, { "name": "securitystudies:type=\"apt\"" }, { "name": "misp-galaxy:threat-actor=\"Lazarus Group\"" }, { "name": "misp-galaxy:country=\"singapore\"" }, { "name": "misp-galaxy:country=\"south korea\"" }, { "name": "misp-galaxy:country=\"japan\"" }, { "name": "misp-galaxy:sector=\"Financial Services\"" }, { "name": "misp-galaxy:sector=\"Cryptocurrency\"" } ], "Attribute": [ { "type": "link", "category": "External analysis", "value": "https://securitystudies.info/cyber/incidents/lazarus-group-cryptocurrency-exchange-heist-singapore/", "comment": "SecurityStudies.info entry", "to_ids": false }, { "type": "link", "category": "External analysis", "value": { "title": "FBI Flash Alert", "url": "https://www.ic3.gov/" }, "comment": "source", "to_ids": false }, { "type": "link", "category": "External analysis", "value": { "title": "Chainalysis Reactor Analysis", "url": "https://www.chainalysis.com/blog/" }, "comment": "source", "to_ids": false }, { "type": "text", "category": "Other", "value": "Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.", "comment": "summary", "to_ids": false } ] } } ] }